Scientific Linux Security Update : libxslt on SL7.x x86_64 (20201001)

Security Fixes : - libxslt: xsltCheckRead and xsltCheckWrite routines security bypass by crafted URL CVE-2019-11068 - libxslt: use after free in xsltCopyText in transform.c could lead to information disclosure CVE-2019-18197 C Tenable Network Security, Inc. The descriptive text is C Scientific...

Scientific Linux Security Update : expat on SL7.x x86_64 (20201001)

Security Fixes : - expat: large number of colons in input makes parser consume high amount of resources, leading to DoS CVE-2018-20843 - expat: heap-based buffer over-read via crafted XML input CVE-2019-15903 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

Scientific Linux Security Update : OpenEXR on SL7.x x86_64 (20201001)

Security Fixes : - OpenEXR: out-of-bounds read during Huffman uncompression CVE-2020-11761 - OpenEXR: std::vector out-of-bounds read and write in ImfTileOffsets.cpp CVE-2020-11763 - OpenEXR: out-of-bounds write in copyIntoFrameBuffer function in ImfMisc.cpp CVE-2020-11764 C Tenable Network...

Scientific Linux Security Update : unoconv on SL7.x (noarch) (20201001)

Security Fixes : - unoconv: mishandling of pathname leads to SSRF and local file inclusion CVE-2019-17400 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141680; scriptversion"1.3";...

Scientific Linux Security Update : python-pillow on SL7.x x86_64 (20201001)

Security Fixes : - python-pillow: out-of-bounds read in ImagingFliDecode when loading FLI images CVE-2020-5313 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141709; scriptversion"1.3";...

Scientific Linux Security Update : openldap on SL7.x x86_64 (20201001)

Security Fixes : - openldap: denial of service via nested boolean expressions in LDAP search filters CVE-2020-12243 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141663; scriptversion"1.3";...

Scientific Linux Security Update : ipa on SL7.x x86_64 (20201001)

Security Fixes : - js-jquery: Cross-site scripting via cross-domain ajax requests CVE-2015-9251 - bootstrap: XSS in the data-target attribute CVE-2016-10735 - bootstrap: Cross-site Scripting XSS in the collapse data-parent attribute CVE-2018-14040 - bootstrap: Cross-site Scripting XSS in the...

Scientific Linux Security Update : httpd on SL7.x x86_64 (20201001)

Security Fixes : - httpd: Improper handling of headers in modsession can allow a remote user to modify session data for CGI applications CVE-2018-1283 - httpd: Out of bounds read in modcachesocache can allow a remote attacker to cause DoS CVE-2018-1303 - httpd: modrewrite configurations vulnerabl...

Scientific Linux Security Update : NetworkManager on SL7.x x86_64 (20201001)

Security Fixes : - NetworkManager: user configuration not honoured leaving the connection unauthenticated via insecure defaults CVE-2020-10754 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141710; scriptversion"1.3";...

Scientific Linux Security Update : libxml2 on SL7.x x86_64 (20201001)

Security Fixes : - libxml2: memory leak in xmlParseBalancedChunkMemoryRecover in parser.c CVE-2019-19956 - libxml2: memory leak in xmlSchemaPreRun in xmlschemas.c CVE-2019-20388 - libxml2: infinite loop in xmlStringLenDecodeEntities in some end-of-file situations CVE-2020-7595 C Tenable Network...

Scientific Linux Security Update : dbus on SL7.x x86_64 (20201001)

Security Fixes : - dbus: DBusServer DBUSCOOKIESHA1 authentication bypass CVE-2019-12749 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141677; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : libmspack on SL7.x x86_64 (20201001)

Security Fixes : - libmspack: buffer overflow in function chmdreadheaders CVE-2019-1010305 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141694; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Scientific Linux Security Update : libexif on SL7.x x86_64 (20201001)

Security Fixes : - libexif: out of bound write in exif-data.c CVE-2019-9278 - libexif: out of bounds read due to a missing bounds check in exifdatasavedataentry function in exif-data.c CVE-2020-0093 - libexif: use of uninitialized memory in EXIF Makernote handling can lead to crashes and...

Scientific Linux Security Update : libvpx on SL7.x x86_64 (20201001)

Security Fixes : - libvpx: Denial of service in mediaserver CVE-2017-0393 - libvpx: Out of bounds read in vp8norm table CVE-2019-9232 - libvpx: Use-after-free in vp8deblock in vp8/common/postproc.c CVE-2019-9433 - libvpx: Out of bounds read in vp8decodeframe in decodeframe.c CVE-2020-0034 C Tenab...

Scientific Linux Security Update : librabbitmq on SL7.x x86_64 (20201001)

Security Fixes : - librabbitmq: integer overflow in amqphandleinput in amqpconnection.c leads to heap-based buffer overflow CVE-2019-18609 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141652; scriptversion"1.3";...

Scientific Linux Security Update : glib2 and ibus on SL7.x x86_64 (20201001)

Security Fixes : - glib2: filecopyfallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress CVE-2019-12450 - ibus: missing authorization allows local attacker to access the input bus of another user CVE-2019-14822 C Tenable Network...

Scientific Linux Security Update : cups on SL7.x x86_64 (20201001)

Security Fixes : - cups: DNS rebinding attacks via incorrect whitelist CVE-2017-18190 - cups: stack-buffer-overflow in libcups's asn1gettype function CVE-2019-8675 - cups: stack-buffer-overflow in libcups's asn1getpacked function CVE-2019-8696 C Tenable Network Security, Inc. The descriptive text...

Scientific Linux Security Update : bluez on SL7.x x86_64 (20201001)

Security Fixes : - bluez: Improper access control in subsystem could result in privilege escalation and DoS CVE-2020-0556 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid141686; scriptversion"1.3";...

Scientific Linux Security Update : SDL on SL7.x x86_64 (20201001)

Security Fixes : - SDL: buffer over-read in IMAADPCMnibble in audio/SDLwave.c CVE-2019-7572 - SDL: heap-based buffer overflow in function MSADPCMdecode in audio/SDLwave.c CVE-2019-7575 - SDL: heap-based buffer over-read in SDLGetRGB in video/SDLpixels.c CVE-2019-7636 - SDL: heap-based buffer...

Scientific Linux Security Update : libsrtp on SL7.x x86_64 (20201001)

Security Fixes : - libsrtp: improper handling of CSRC count and extension header length in RTP header CVE-2015-6360 - libsrtp: buffer overflow in application of crypto profiles CVE-2013-2139 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if...